Hi, so I recently switched to using PassportJS for the first time and it's been alright so far. I'm using the following middleware function to protect routes in my Next.js application:

export async function middleware(request: NextRequest) {
  const authCookie = request.cookies.get("connect.sid")?.value;

  // Not logged in
  if (!authCookie) {
    return NextResponse.redirect(new URL("/login", request.url));
  }

  try {
    const getMeRequest = await axiosInstance.get("/auth/me", {
      headers: {
        Cookie: `connect.sid=${authCookie}`,
      },
    });

    // Valid session
    const response = NextResponse.next();
    response.headers.set("X-User-Data", JSON.stringify(getMeRequest.data));
    return response;
  } catch (err) {
    if (err instanceof AxiosError && err.request.status == 401) {
      // Invalid session
      return NextResponse.redirect(new URL("/login", request.url));
    } else {
      // Unknown error
      return NextResponse.redirect(
        new URL("/unknown-error?type=auth", request.url)
      );
    }
  }
}

export const config = {
  matcher: "/protected-routes/:path*",
};

Is this approach correct, or are there better practices for handling route protection and authentication with PassportJS in a Next.js application? Also, are there any potential security concerns or improvements that can be made to this implementation?